Run (on linux) netstat -nltp and netstat -nlup . This should show you what is listening on each TCP and UDP port, respectively. It is very likely that syslog is in fact already running on port 514. Disabling syslog completely is probably not what you would want to do to remedy this, because it takes care of the local logging service. Without syslog you would not have /var/log/messages. To just turn off syslog's network bindings (port 514), then refer to your OS's syslog documentation. ... View more